Systems and methods for forgery detection and deterrence of printed documents

ABSTRACT

A print management system includes a policy that determines a protection level for a document to be printed. The document is printed using forgery detection and deterrence technologies, such as fragile and robust watermarks, glyphs, and digital signatures, that are appropriate to the level of protection determined by the policy. A plurality of printers are managed by a print management system. Each printer can provide a range of protection technologies. The policy determines the protection technologies for the document to be printed. The print management system routes the print job to a printer that can apply the appropriate protections and sets the appropriate parameters in the printer. Copy evidence that can establish that a document is a forgery and/or tracing information that identifies the custodian of the document and restrictions on copying of the document and use of the information in the document are included in the watermark that is printed on the document. A document can be verified as an original or established as a forgery by inspecting the copy evidence and/or tracing information in the watermark.

BACKGROUND OF THE INVENTION

1. Field of Invention

This invention relates to document forgery protection systems andmethods.

2. Description of Related Art

Various techniques are known for detecting and/or deterring forgery ofan original printed document. Document forgery includes bothunauthorized alteration of the original document and unauthorizedcopying of the original document. Previously, watermarks have beenapplied to documents to detect and/or deter forgery. Watermarks areprinted marks on a document that can be visually detected or detectedusing special equipment. Fragile watermarks are marks that appear in anoriginal printed document but that will not appear in a copy of theoriginal document made on a standard photocopier or will be detectablydegraded in the resulting copy of the document.

Robust watermarks are marks in an original document that will beaccurately reproduced on any copy of the original document made on anstandard photocopier so that information contained in the watermark canbe extracted from the copy. There are two types of robust watermarksthat can be used. The first type of robust watermark is a mark thatappears on both the original document and a copy. The second type ofrobust watermark is a mark that is present, but that is not readilyvisible, on the original document, but that becomes clearly visible on acopy of the original document. The second type of robust watermark isalso known as an invisible robust watermark.

Forgery of an original document containing a fragile watermark bycopying the original document is easily detected by the absence of thewatermark on the copy of the original document. Forgery of an originaldocument containing the first type of robust watermark is detected byextracting information contained in the robust mark. This informationcould identify a custodian of the original document and informationrelating to copy restrictions or other restrictions as to the use of theinformation in the original document. Forgery of an original documentcontaining the second type of robust watermark is detected by thevisible presence of the watermark on the copy of the original document.For example, the information contained in the second type of robustwatermark could be a banner that reads “This is a copy” or a similarwarning.

SUMMARY OF THE INVENTION

This invention provides systems and methods for adding fragile androbust watermarks to an original document as it is printed.

This invention separately provides systems and methods for printing adocument requiring forgery protection using a number of trustedprinters.

This invention separately provides a series of trusted printers thattogether permit differing levels of forgery protection to be provided toa document to be printed.

In accordance with various exemplary embodiments of the systems andmethods according to this invention, a family of trusted printers ismanaged to provide a range of different forgery detection and deterrencetechniques. The protection requirements for an original document to beprinted are determined by a trusted printing policy. The factors used todetermine the protection requirements required for the original documentto be printed include the value of the document being created,assumptions about the resources available to an adversary or attacker,such as a potential forger, and the cost of providing the protections tothe original document to be printed.

When an original document requiring forgery protection is to be printed,the print job for that document is routed to a trusted printer that canprint a watermark that includes copy evidence and/or tracing informationnecessary to obtain the required level of protection. Copy evidence isevidence that can be obtained through an inspection of a document thatindicates whether that particular document is an unauthorized copy of anoriginal document. Tracing information is information printed on adocument that identifies the custodian(s) of the original document andrestrictions on further copying that apply to the custodian(s) and tothe original document. Other information may also be included in thetracing information that serves to more uniquely identify the original.The required copy evidence is applied to the printed document throughthe use of fragile watermarks or robust watermarks.

The required tracing information is applied to the printed documentthrough the use of robust watermarks. The parameters of the selectedtrusted printer are set by a print management system to print thewatermark(s), including the copy evidence and/or tracing information,appropriate to the required level of protection.

These and other features of the invention will be described in or areapparent from the following detailed description of various exemplaryembodiments of systems and methods according to this invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Various exemplary embodiments of systems and methods according to thisinvention will be described with reference to the following drawings,wherein:

FIG. 1 is a schematic diagram illustrating a print management systemaccording to this invention;

FIG. 2 is a flowchart of a document forgery protection printing methodaccording to an exemplary embodiment of this invention;

FIG. 3 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 4 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 5 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 6 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 7 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 8 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 9 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

FIG. 10 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;and

FIG. 11 is a flow diagram of a document forgery protection printing anddetection system according to an exemplary embodiment of this invention;

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

FIG. 1 is a schematic diagram illustrating a system for policy basedprinting. A network 100 includes at least one server 110 that controls aplurality of computers 121, 122 and 23. The server 110 also controls afamily 130 of trusted printers 131–135. A trusted printer is a printerthat is available only to authorized users of the network 100. Theserver 110 includes an operating system 111 that allows users of thenetwork 100 to use various applications stored in the server 110 on thecomputers 121, 122 and 123. The applications may include, for example,word processing applications, spreadsheet applications, image scanningand/or processing applications, and/or database management applications.Authorized users of the computers 121, 122 and 23 can use theapplications stored in the server 110 and controlled by the operatingsystem 111 to create documents 140. The applications process images ofthe document 140 that can be viewed on the display units 151, 152 and153 of the respective computers 121, 122 and 123.

The document 140 can be printed by entering a print command into one ofthe computers 121 or 122 or 123 and sending a print job to the server110. The operating system 111 includes a print management system 112that selects one of the family 130 of the trusted printers 131–135 thatcan provide a required level of protection for the document 140 to beprinted. The print management system 112 includes a policy 113 that mapsthe document protection requirements to the specific security protectiontechniques available from the family 130 of the trusted printers131–135.

The policy 113 determines the required protection level for the document140 to be printed by collecting information about the value of thedocument 140 from the document creator or owner or from any other personauthorized to print the document 140. The information may includeassumptions about potential forgery and the cost necessary to provide alevel of protection to detect and/or deter the potential forgery. Theuser may enter the information about the document 140 through agraphical user interface provided on one of the display units 151–153 ofthe particular computers 121–123 being used to print the document 140.

The print management system 112 may also allow the users to questioneach of the trusted printers 131–135 to determine what protection leveleach trusted printer 131–135 provides. The print management system 112may also provide information to the user about which forgery techniqueseach protection level is able to detect and/or deter and the costs ofusing each protection level. Each computer 121–123 may be controlled bythe print management system 112 and/or the operating system 111 todisplay to users the protection levels that may be applied to thedocument 140 to be printed.

Each document 140 to be printed may also have a security level embeddedin it, attached to it or otherwise associated with it, that the printmanagement system 112 can use to identify the specific combination ofprotection techniques needed to detect and/or deter potential forgery.The policy 113 is programmable and may be adapted to the particularrequirements of the organization that operates, owns or uses the network100. The policy 113 may be programmed to assign a protection level orlevels for every authorized user of the network 100 or for everycomputer 121–123 of the network 100.

Every user of the network 100 may have an identification that isprogrammed into the policy 113. The identification may be a loginpassword or user identification. Every document 140 printed by the useridentified by the identification may have be assigned a specifiedprotection level, a minimum protection level and/or a maximum protectionlevel.

Every computer 121–123 of the network 100 may have an identificationvalue. The computer identification values may be programmed into thepolicy 113. Every print job sent by the identified one of the computers121–123 to the server 110 may have a specified protection level, aminimum protection level and/or a maximum protection level. The policy113 determines the protection requirements for the document 140 to beprinted by identifying the user that enters the print command and/or thecomputer 121–123 that sends the print job.

The policy 113 may also conduct a search of the content of the document140 to determine the required protection level. The search could be, forexample, a keyword search or a keyphrase search of the document 140. Theprotection requirements of the document 140 could be dependent on thenumber of occurrences of various ones of the keywords or keyphrases.

The policy 113 determines the security requirements for the document 140to be printed. For example, the policy 113 may determine that thedocument 140 to be printed requires protection against forgery bycopying using a standard photocopier. Alternatively, the policy 113 maydetermine that the document 140 to be printed requires protectionagainst scanning, image processing, and alteration of the contents ofthe document 140. Once the policy 113 determines the securityrequirements, the print management system 112 identifies the specificcombination of protection techniques needed to meet these requirements.The print management system 112 then routes the print job to one of thetrusted printers 131–135 that can apply the appropriate protections andsets the parameters in the selected printer to apply the appropriateprotection techniques to the document 140. Examples of the protectionlevels that can be applied to the document 140 when it is printed, theforgery techniques that the protection levels protect against and theequipment necessary for creating the protection level and verifying theauthenticity of a document are described in Table 1.

TABLE 1 Protection Levels Technique(s) Protects Against Equipment NeededLevel 0 Fragile variable Adversary with Standard color copy evidentstandard copier and printer, or special watermark. toner or ink. Blanktoner or ink, or originals attack. hyperacuity printer with inspector.Level 1 Robust variable Adversary who can Standard color invisible copyremove copy printer with special evident water- evident watermarks toneror ink. mark with trac- from originals. ing information. Blank originalsattack. Compro- mised tracing attack. Level 2 Fragile variable Weakprotection Special toner or ink fluorescing against tampering. andstandard high- invisible copy Blank originals light or color evidentwater- attack. printer. Enhance- mark to print ments could include pageoffset, with toner sensor or tracing informa- sensors to verify thetion. presence of the copy-evident water- mark. Fluorescent light toverify. Level 3 Fragile variable Adversary who Special toner or inkfluorescing can scan, image and standard high- invisible copy process,and light or color evident water- print and who printer. Enhance- markto print has access to ments could include page offset, with the specialtoner toner sensor or tracing informa- or ink. sensor to verify thetion, digitally presence of the signed and glyph copy evident water-encoded. mark. Fluorescent light and fluorescent scanner to verify.Level 4 Fragile variable Adversary who Special toner or ink fluorescingcan scan, image and standard high- invisible copy process, and light orcolor evident water- print and who printer. Enhance- mark to print hasthe special ments could include random portions toner or ink. tonersensor or of the page, sensors to verify the with tracing presence ofthe information, copy evident water- digitally signed mark. Fluorescentand glyph light and fluorescent encoded. scanner to verify. Level 5Robust variable Adversary with Fluorescing black fluorescing blackstandard standard toner or ink in a copy evident copier and toner orstandard highlight watermark with ink. Compromised or color printer.tracing informa- tracing attack. Fluorescent light tion. to verify.Level 6 Robust variable Adversary with Fluorescing black fluorescingblack standard copier and toner or ink in a copy evident tone or ink.standard highlight watermark with Detached toner or color printer.tracing informa- attack. Blank Fluorescent light tion to print originalsattack. to verify. fixed portions of the page. Level 7 Robust variableAdversary with Fluorescing black fluorescing black standard copier andtoner or ink in a copy evident toner or ink. standard highlightwatermark to Adversary with a or color printer. print random scanner andFluorescent light portions of the image processor. to verify. Inspectorpage, with the Detached toner to read and verify random pattern attack.Compro- the glyph. specification mised tracing encrypted and attack.glyph encoded Level 8 Robust variable Adversary who Fluorescing blackfluorescing black alters tracing infor- toner in a standard copy evidentmation. Adversary highlight or color watermark to with standard copierprinter. Fluorescent print content and ink. Adversary light to verify.dependent por- who can scan and Inspector to read tions of the imageprocess. and verify the page, with Detached toner or glyph. tracinginfor- ink attack. Com- mation, encrpyted promised tracing and glyphattack. encoded

Although Table 1 shows various watermarking techniques usable eitheralone or in combination to provide a specified level of protection to adocument, it should be appreciated that the table is merely oneexemplary embodiment of a policy 1113. Other combinations ofwatermarking techniques may be provided to enable a greater range ofprotection levels.

As shown in FIG. 1, the trusted printer 131 can print documents havingLevel 0 protection, the trusted printer 132 can print documentsrequiring Level 1 protection, the trusted printer 133 can printdocuments requiring Level 0 through Level 4 protection, the trustedprinter 134 can print documents requiring Level 4 through Level 8protection and the trusted printer 135 can print documents requiringLevel 7 and Level 8 protection.

FIG. 2 is a flowchart of one exemplary embodiment of a document forgeryprotection printing method according to this invention. Beginning instep S1000, control continues to step S1100, where a user creates adocument that requires forgery protection. Then, in step S1200, the userenters a print command to print the document requiring forgeryprotection. Next, in Step S1300, information about the protection levelsis displayed to the user. Control then continues to step S1400.

In Step S1400, information is collected about the value of the documentrequiring forgery protection. The information may include information orassumptions about potential forgery of the document requiring forgeryprotection and the cost of applying the various available protectiontechniques to the document requiring forgery protection. Next, in stepS1500, the protection requirements of the document requiring forgeryprotection are determined based on a trusted printing policy. Thedetermined protection requirements for the document requiring forgeryprotection may indicate that this document requires protection againstforgery from copying using a standard photocopier or that the documentrequiring forgery protection requires protection against forgery byscanning, image processing and altering of the contents of the document.Then, in step S1600, the protection level that provides the specificcombination of protection techniques to meet the determined protectionrequirements is determined. Control then continues to step S1700.

In step S1700, a trusted printer that can apply the appropriateprotection techniques to the document requiring forgery protection isselected based on the determined protection level. Then, in step S1800,the print job for the document requiring forgery protection is routed tothe selected trusted printer. Next, in step S1900, the parameters in theselected trusted printer are set based on the determined protectionlevel. In step S2000, the document requiring forgery protection,including the protection techniques of the determined protection level,is printed using the selected trusted printer. Then in step S2100 themethod ends.

Although one exemplary embodiment of a document forgery protectionprinting method according to this invention has been described abovewith respect to FIG. 2, it should be appreciated that other exemplaryembodiments of document forgery protection printing methods may beapparent to those of ordinary skill in the art. For example, in variousexemplary embodiments of the document forgery protection printing methodaccording to this invention, the information about the protection levelsmay be displayed prior to the print command being entered. In othervarious exemplary embodiments of the document forgery protectionprinting method invention of this invention, the information about thevalue of the document and the potential forgery of the document may alsobe collected prior to the print command being entered. In other variousexemplary embodiments of the document forgery protection printing methodaccording of this invention, the parameters of the selected trustedprinter may be set prior to the print job being routed to the selectedtrusted printer.

As shown in FIG. 1, the trusted printers 131 and 133 can print documentshaving Level 0 protection. As shown in Table 1, Level 0 protectionincludes a fragile variable copy evident watermark. As shown in FIG. 3,the content owner, who may be anyone authorized to create the document140, view the document 140, and/or print the document 140, providesimage data from an image data source, which may be one of the computers121–123 or an external data storage device, to an image processor, whichmay be an application stored on the server 110, to create the document140.

Copy evidence is also provided to the image processor and included withthe contents of the document 140. The copy evidence included in thedocument 140 can vary with the page of the document 140 and couldinclude information identifying the contents of the page, the pagenumber or identifier, the author, the document title, the date, thetime, and the originating organization. The copy evidence could alsoinclude characteristics about the trusted printer 131 or 133 or a uniquecopy number recorded by the trusted printer 131 or 131. The copyevidence may be provided by the content owner through a graphical userinterface provided on one of the display units 151–153 of one of therespective computers 121–123, or may be determined automatically by theoperating system 111, the print management system 112, and/or the policy113. The copy evidence is encoded in a fragile variable copy evidentwatermark. Because the copy evidence varies with each page of thedocument, the fragile variable copy evident watermark varies with eachpage.

The fragile variable copy evident watermark of Level 0 may be formed byany known technique for forming fragile watermarks. Techniques forforming fragile watermarks include, for example, microvariations in inkdensity within the letters, extremely small glyphs contained in theletters, very small marks or textures, possibly in color, that areprinted on the background or one or more unused portions of the sheet ofrecording material that the document is printed on that are made toappear as shading or fibers in the sheet of recording material,hyperacuity pixels within characters of text, and serpentones withincolor or black and white images.

If the policy 113 determines that the security requirements for thedocument 140 to be printed require a fragile variable copy evidentwatermark, the print management system 112 routes the print job toeither trusted printer 131 or 133. The print management system 112 alsosets the parameters in the trusted printer 131 or 133 to print thefragile variable copy evident watermark.

The fragile variable copy evident watermark may be made more difficultto forge by encoding the copy evidence in the fragile variable copyevident watermark so that the information can only be decoded by asecret key contained in the trusted printer 131 or 133 or belonging tothe content owner. The copy evidence contained in the fragile variablecopy evident watermark may also depend on unique physicalcharacteristics of the trusted printer 131 or 133. For example, a randompattern may be applied to the document by the trusted printer 131 or 133as disclosed in U.S. application Ser. No. 09/504,036, incorporatedherein by reference in its entirety. Copy evidence unknown to anadversary, such as a forger, could also be encoded in the fragilevariable copy evident watermark or the fragile variable copy evidentwatermark could be printed using methods that are difficult or veryexpensive to reproduce such as, for example, spectral modulation.

As shown in Table 1, the trusted printer 131 or 133 may be a standardcolor printer or a standard printer provided with special toner or ink,such as, for example, fluorescing or magnetic toner or ink. The trustedprinter 131 or 133 may also be a hyperacuity printer that can printserpentones. An inspector device may be used to verify the presence ofthe serpentones, or the presence of the special toner or ink. Theinspector device can also read the contents of the fragile variable copywatermark. Such printers and inspector devices are disclosed in U.S.Pat. Nos. 5,706,099 and 5,710,636, each incorporated herein by referencein its entirety.

As shown in FIG. 3, the trusted printer 131 or 133 prints the document140 on standard paper. Standard paper is paper that does not necessarilyhave a preprinted watermark. As shown in FIG. 3, a document 140 printedwith the fragile variable copy evident watermark of Level 0 is protectedagainst an adversary having access to the original printed document anda standard photocopier with standard toner or ink. A visual inspectorcan verify if a document is an original or a forgery. The visualinspector may be any person authorized to inspect documents forauthenticity. A document is verified as an original by the undistortedappearance of the fragile variable copy evident mark. A document isestablished as a forgery by the absence, or the discolored appearance,of the fragile variable copy evident mark. Depending on the technologyused to generate the copy evident watermark, the inspector device may berequired to verify the presence of, and read the contents of, the copyevident watermark.

As shown in FIG. 3, because the copy evidence in the fragile copyevident watermark of Level 0 varies with the page printed, Level 0 alsoprotects against a blank originals attack. A blank originals attack isattempted forgery by copying of the original document on blankoriginals. Blank originals are sheets of recording material containing apreprinted fragile watermark However, the preprinted fragile watermarkof the blank originals does not vary with the page printed. Thus, thepresence of the non-varying preprinted fragile watermark can be detectedby the visual inspector. Detecting of a non-varying fragile watermarkestablishes a document as a forgery.

As shown in FIG. 1, trusted printers 132 or 133 can print documentshaving Level 1 protection. As shown in Table 1, Level 1 protectionincludes a robust invisible variable copy evident watermark with tracinginformation. The robust invisible variable copy evident watermark may beformed by any known or later developed technique for forming robustwatermarks. Techniques for forming robust watermarks include, forexample, slight vertical translations of letters with respect to abaseline, slight variations of spacing between letters, line indents,margins, and/or line spacings. The robust watermarks may also be formedby adding luminance or gray-scale noise-like patterns.

The robust invisible variable copy evident watermark of Level 1 can beused to encode the copy evidence and the tracing information. The copyevidence included in the document 140 can vary with the page of thedocument 140 and could include information identifying the content ofthe page, the page number or identifier, the author, the document title,the date, the time, and the originating organization. The copy evidencecould also include characteristics about the trusted printer 132 or 133or a unique copy number recorded by the trusted printer 132 or 133. Thecopy evidence can also include a large banner that prominently displaysa warning statement, such as, for example, “This is a copy” or somesimilar warning. The tracing information may include, for example,information identifying to whom the original document was given, who isauthorized to possess the document, and information relating to copyrestrictions or other restrictions as to the use of the information inthe document. The tracing information can be specified in DigitalProperty Rights Language. The copy evidence and tracing information areencoded in the robust invisible variable copy evident watermark.

As shown in FIG. 4, the content owner provides image data from an imagedata source, which may be one of the computers 121–123 or an externaldata storage device, to an image processor, which may be an applicationstored on the server 110, to create the document 140. Copy evidence andtracing information is also provided to the image processor and includedwith the contents of the document 140. During image processing of thedocument 140, the copy evidence and the tracing information are includedin the contents of the document 140. The copy evidence and the tracinginformation included in the document 140 may be entered by the contentowner through a graphical user interface provided on one of the displayunits 151–153 of one of the respective computers 121–123, or may bedetermined automatically by the operating system 111, the printmanagement system 112, and/or the policy 113.

The print management system 112 routes the print job to the trustedprinter 132 or 133 and the document is printed on standard paper. Asshown in FIG. 4, Level 1 provides protection against an adversary whohas access to the original document 140 and a standard photocopier andstandard paper and toner or ink. If the adversary copies the originaldocument 140 on the standard photocopier using standard toner or ink andstandard paper, a visual inspector can establish the resulting copy as aforgery by noting the clearly visible appearance of the robust variablecopy evident watermark on the resulting copy. If a document appears tolack the robust variable copy evident watermark, this is evidence thatthe document may be an original, but a second tier inspection isrequired.

As shown in FIG. 4, the second tier inspection can determine if adocument is an original. The document is copied on a standard copierusing standard paper. If the resulting copy contains a clearly visiblewatermark, the original document can be verified as an original.

As shown in Table 1, Level 1 provides protection against an adversarythat can remove the robust variable copy evident watermark by, forexample, scanning the document and removing or deleting the watermarkduring image processing. As shown in Table 1 and FIG. 4, Level 1 alsoprovides protection against blank originals attacks. Level 1 alsoprotects against a compromised tracing attack, where the adversaryintercepts or tampers with the source of the tracing information. Thetrusted printer 132 or 133 may be an standard color printer providedthat may use special toner or ink including, for example, fluorescingtoner or ink.

As shown in FIG. 1, the trusted printer 133 can print documents havingLevel 2 protection. As shown in Table 1, Level 2 protection includes afragile variable fluorescing invisible copy evident watermark withtracing information. The copy evidence may include the text of the pageoffset by some distance, but in any event depends on the contents of thepage. The copy evidence and the tracing information may be encoded inthe fragile variable fluorescing invisible copy evident watermark. Asshown in FIG. 5, the document, including the contents, the copy evidenceand tracing information, is printed by the trusted printer 133 onstandard paper using a special toner or ink. The special toner or ink isinvisible fluorescing toner or ink. As shown in Table 1, the trustedprinter 133 can be a standard highlight or color printer that issupplied with the fluorescing invisible toner or ink. A sensor on theoutput of the printer could verify that the copy-evident mark isproperly printed.

The variable nature of the copy-evident mark prevents a blank originalsattack where the adversary pre-processes the paper by putting thespecial marks on it. The identifying information also allows for tracingthe source of the unauthorized copy action. That is, the underlyinginformation identifies who had custody over the original and should havebeen protecting it. The Level 2 protection might also be used to givesome protection against an adversary who tries to tamper with thecontents of the document, because the two printings on the page would bevisually different under fluorescent light.

As shown in Table 1 and in FIG. 5, Level 2 provides protection againstan adversary who has access to the original document and a standardphotocopier with standard toner or ink. A document can be verified as anoriginal by illuminating that document with fluorescence-exciting light.If the document contains a watermark that fluoresces under thefluorescence-exciting light and that matches the visible contents of thepage, the document can be verified as an original. If the document doesnot have a watermark, if the document contains a watermark that does notfluoresce under fluorescence-exciting light, or if the document containsa watermark that fluoresces but does not match the visible contents ofthe page, the document can be established as a copy.

As shown in FIG. 1, the trusted printer 133 can print documents havingLevel 3 protection. As shown in Table 1, Level 3 protection includes afragile variable fluorescing invisible copy evident watermark withtracing information. The mark includes a copy or a portion of the textof the page offset to the right by some distance and printed usinginvisible fluorescing toner. Tracing information such as printer, user,timestamp, document-id, and page number is also printed using theinvisible ink. The information contained in the copy evident mark isdigitally signed and encoded into a glyph code that is printed in theleft margin of the page.

As shown in Table 1 and FIG. 6, Level 3 provides protection against anadversary who can scan, image process, and print, and thus attempt totamper with the content of the document, and who has access to thespecial ink used. Protection against a naive attacker is via afluorescent detector as in Level 2 protection. Additional tamperprotection and authenticity is provided by the digital signature encodedin the glyph code.

Special inks and an ordinary highlight printer or an ordinary colorprinter can be used to print the original documents. Enhancements to theprinter can include sensors to check that fluorescent toner is loadedand used. Additionally, a sensor on the output of the printer can beused to verify that the copy evident mark is properly printed. Afluorescence-exciting light source can be used to expose the copyevident mark and a fluorescent light scanner can be used to read theinformation printed in fluorescent ink. This method is backwardcompatible with Level 2 protection.

As shown in FIG. 6, a document may be verified as an original by thepresence of a fluorescent copy-evident mark that matches the visiblecontent the page or by successful verification of the digital signatureencoded in the glyph code. A document may be verified as a copy by theabsence of the fluorescent copy evident mark. If the fluorescent copyevident mark exists, the document may still be verified as a copy if thedigital signature cannot be successfully verified.

As shown in FIG. 1, the trusted printers 133 and 134 can print documentshaving Level 4 protection. As shown in Table 1, Level 4 protectionincludes a fragile invisible fluorescing variable copy evident watermarkto print randomly generated patterns. Tracing information is alsoincluded in the copy evident watermark. The random pattern of the copyevident mark is digitally signed and encoded into a glyph code, that isprinted on the page.

As shown in FIG. 7, Level 4 provides protection against an adversary whohas access to a scanner, image processing software, and a color printer,as well as access to the special ink used, and who may attempt to usethese to tamper with the content of the document or to forge anacceptable copy evident mark. Additional tamper protection andauthenticity is provided by the digital signature encoded in the glyphcode.

Special inks and an ordinary highlight printer or ordinary color printercan be used to print the original documents. Enhancements to the printercould include sensors to check that fluorescent toner is loaded andused. Additionally, a sensor on the output of the printer can be used toverify that the pattern is properly printed. A fluorescence-excitinglight source can be used to expose the copy evident mark. A fluorescentlight scanner can be used to read the information printed in thefluorescent ink.

As shown in FIG. 7, a document may be verified as an original if thefluorescent pattern measured from the paper matches the pattern encodedin the glyph code or by successful verification of the digitalsignature. A document may be verified as a copy by the absence of thefluorescent copy evident watermark. If the copy evident mark is present,the document may still be verified as a copy if the fluorescent patternmeasured from the paper fails to match the pattern encoded in the glyphcode. A document may also be verified as a copy if the digital signaturecannot be successfully verified.

As shown in FIG. 1, the trusted printer 134 can print documents havingLevel 5 protection. As shown in Table 1, copy evidence is provided bythe use of a robust fluorescing black copy evident mark. Tracinginformation is encoded in the mark. As shown in FIG. 8, Level 5 providesprotection against an adversary who uses a standard copier to make anunauthorized copy or attempted forgery, and who does not have access tothe fluorescing ink. The equipment that can be used to enable Level 5protection is fluorescing black toner in an ordinary highlight or colorprinter. A fluorescence-exciting light source can aid in theverification of the copy evident watermark.

A document may be verified as an original by visually inspecting thedocument. Visual inspection reveals the fluorescing black copy evidentmark. A document may be verified as a copy by the absence of the copyevident mark, or a copy evident mark printed in ordinary ink.

As shown in FIG. 1, the trusted printer 134 can print documents havingLevel 6 protection. As shown in Table 1, copy evidence is provided bythe use of a robust fluorescing black copy evident mark. For example,such a mark could be created by printing fluorescing invisible ink overordinary black ink. The fluorescent black ink is used to print fixedportions of the document contents (the portion selected to be printed inthis way does not depend on the document contents). Tracing informationcan also be encoded in the mark. As shown in FIG. 9, Level 6 providesprotection against an adversary who uses a plain copier to make anunauthorized copy or attempted forgery and who does not have access tothe special ink. Level 6 also protects against an adversary withphysical access to the trusted printer that detaches the fluorescingtoner, since this would cause portions of the printed page to disappear.

The equipment that can be used to provide Level 6 protection includesfluorescing black toner or ink in an ordinary highlight or color printeror a combination of fluorescing invisible ink and ordinary black ink. Aspecial viewer can be used to detect and verify the correct pattern ofthe copy evident watermark.

As shown in FIG. 9, a document may be verified as an original byvisually inspecting the document to verify that the entire contents ofthe document page have been printed. A special viewer may be used toverify that part of the visible contents of the document fluoresces orto verify the correct fluorescent pattern. A document may be verified asa copy by visually inspecting the document. If a portion of the page hasnot been printed, the document can be verified as a copy. If the entirepage has been printed, the document may be verified as a copy by theabsence of the fluorescing black copy evident mark, or by the existenceof a non-fluorescing copy evident mark. A document may be verified as acopy if the special viewer reveals an incorrect fluorescing pattern inthe copy evident mark.

As shown in FIG. 1, the trusted printers 134 and 135 can print documentshaving Level 7 protection. As shown in Table 1, Level 7 protectionincludes a robust fluorescent black variable copy evident watermark. Asshown in FIG. 10, the fluorescent black toner or ink is used to printrandomly selected portions of the content of the document. Theinformation about which pattern is used is encrypted and encoded as aglyph code that is printed on the document using a key that is known tothe trusted printers 134 and 135 and to an inspector device. Theinspector device can read the glyph code, decode the glyph code to getthe encrypted pattern information, and decrypt the pattern information.The copy evidence and the tracing information are also encoded in thewatermark.

As shown in FIG. 10, Level 7 provides protection against an adversarythat has access to an original document and the trusted printer 134 or135 but does not have access to the fluorescent black toner or ink.Level 7 also protects against an attacker with physical access to thetrusted printer that detaches the fluorescing toner, since this wouldcause portions of the printed page to disappear. Level 7 also protectsagainst an attacker who has a scanner and an image processor.

Verification of a document as an original can be done usingfluorescence-exciting light. If portions of the document fluoresces whenexposed to fluorescence-exciting light, is evidence that the documentmay be an original. A second tier inspection is necessary. The inspectordevice verifies that the decrypted glyph-encoded information matches thefluorescent pattern. If portions of the document are missing, thedocument can be verified as a copy. If the entire document is printedbut has no watermark or a black watermark that does not fluoresce, thedocument can be established as a copy. If the document has fluorescentportions but the decrypted glyph encoded information does not match thefluorescent pattern, the document can be established as a copy. If thedecoded, decrypted pattern information matches the detected pattern, thedocument can be verified as an original.

The trusted printers 134 and 135 can be standard highlight or colorprinters provided with fluorescent black toner.

As shown in FIG. 1, the trusted printers 134 and 135 can print documentshaving Level 8 protection. As shown in Table 1, Level 8 protectionincludes a robust fluorescing black variable copy evident watermark toprint content dependent portions of the document, with tracinginformation that is encrypted given a key known to the printer and tothe inspector device and glyph encoded. The watermark includes selectedportions of the document's contents that are printed in fluorescingblack toner or ink. The selected portions are selected as a function ofthe document's content. Information about the user and about the trustedprinter 135 and the fluorescing pattern are encrypted and encoded in aglyph code that is printed on the document.

As shown in Table 1, Level 8 provides protection against an adversarythat has access to the original document and a standard copier andstandard toner or ink. As shown in FIG. 11, Level 8 also protectsagainst an adversary that has access to the original document, ascanner, an image processor and the trusted printer 134 or 135 and whotries to alter the tracing information. Even if the attacker tries toalter the tracing information, the attacker doesn't know the key toencrypt or decrypt the tracing information. Level 8 also protectsagainst a detached toner attack, since this would cause portions of theprinted page to disappear.

Establishing a document as a copy can also be done by a visualinspection. If portions of the printed document are missing, thedocument can be established as a copy. If the entire document is printedbut has no visible watermark or a visible watermark that does notfluoresce, the document can be established as a copy. A second tierinspection determines if the pattern information that is decoded anddecrypted from the glyph code by the inspector device matches thefluorescent pattern detected by a fluorescent light scanner. If thedecoded, decrypted pattern information matches the detected pattern, thedocument can be verified as an original.

The trusted printers 134 and 135 can be standard highlight or colorprinters provided with fluorescent black toner. A fluorescent lightscanner can be used to detect the fluorescent pattern and an inspectordevice can be used to read the glyph, decode the glyph to get theencrypted pattern information, decrypt the pattern information and matchthe pattern information against the detected fluorescent pattern.

While this invention has been described in conjunction with the variousexemplary embodiments outlined above, it is evident that manyalternatives, modifications and variations will be apparent to thoseskilled in the art. Accordingly, the various exemplary embodiments ofthe invention, as set forth above, are intended to be illustrative, notlimiting. Various changes may be made without departing from the spiritand scope of the invention.

1. A document forgery protection printing method, comprising: processingan image of a document including at least one page; determining aforgery protection level to be applied to the document based on a policythat determines the forgery protection level for the document, thepolicy using a plurality of factors including at least contents relatedto the documents; and based on the determined protection level, printingat least one watermark including copy evidence and tracing informationon each page of the document that corresponds to the determinedprotection level.
 2. The method of claim 1, wherein the copy evidence isencoded in the watermark.
 3. The method of claim 1, wherein the copyevidence varies with each page of the document.
 4. The method of claim3, wherein the watermark comprises the contents of each page printedusing at least one of invisible fluorescing toner and invisiblefluorescing ink and is offset from the visible contents of each page. 5.The method of claim 4, wherein the tracing information is digitallysigned and encoded in a glyph and printed using at least one ofinvisible fluorescing toner and invisible fluorescing ink and located ina margin of each page.
 6. The method of claim 1, wherein the watermarkcomprises random generated patterns printed using at least one ofinvisible fluorescing toner and invisible fluorescing ink.
 7. The methodof claim 6, wherein the randomly generated patterns are digitally signedand encoded in a glyph code.
 8. The method of claim 1, wherein thewatermark is printed using at least one of fluorescing black toner andfluorescing black ink and combinations of fluorescing invisible ink andtoner and ordinary black ink and toner.
 9. The method of claim 8,wherein the tracing information is encoded in the watermark.
 10. Themethod of claim 1, wherein the watermark comprises of fixed portions ofeach page printed using at least one of fluorescing black toner andfluorescing black ink and combinations of fluorescing invisible ink andtoner and ordinary black ink and toner.
 11. The method of claim 1,wherein the watermark comprises random portions of each page printedusing at least one of fluorescing black toner and fluorescing black ink.12. The method of claim 11, wherein a random pattern used to determinethe random portions of each page is encrypted and encoded in a glyphcode.
 13. The method of claim 1, wherein the watermark comprises contentdependent portions of each page printed using at least one offluorescing black toner and fluorescing black ink.
 14. A documentforgery protection printing system, comprising: at least one imageprocessor that processes an image of document including at least onepage; at least one server having a print management system and a policythat determines a forgery protection level for the document, the policyusing a plurality of factors including at least contents related to thedocuments; a plurality of printers, each printer able to print thedocument and able to apply at least one protection level to the documentby printing at least one watermark including copy evidence and tracinginformation on the document that corresponds to the determinedprotection level.
 15. The document forgery protection printing system ofclaim 14, wherein the copy evidence is encoded in the watermark.
 16. Themethod of claim 14, wherein the copy evidence varies with each page ofthe document.
 17. The method of claim 16, wherein the watermarkcomprises the contents of each page printed using at least one ofinvisible fluorescing toner and invisible fluorescing ink and is offsetfrom the visible contents of each page.
 18. The method of claim 17,wherein the tracing information is digitally signed and encoded in aglyph and printed using at least one of invisible fluorescing toner andinvisible fluorescing ink and is located in a margin of each page. 19.The method of claim 14, wherein the watermark comprises random generatedpatterns printed using at least one of invisible fluorescing toner andinvisible fluorescing ink.
 20. The method of claim 19, wherein therandomly generated patterns are digitally signed and encoded in a glyphcode.
 21. The method of claim 14, wherein the watermark is printed usingat least one of fluorescing black toner and fluorescing black ink. 22.The method of claim 21, wherein the tracing information is encoded inthe watermark.
 23. The method of claim 14, wherein the watermarkcomprises of fixed portions of each page printed using at least one offluorescing black toner and fluorescing black ink.
 24. The method ofclaim 14, wherein the watermark comprises random portions of each pageprinted using at least one of fluorescing black toner and fluorescingblack ink.
 25. The method of claim 24, wherein a random pattern used todetermine the random portions of each page is encrypted and encoded in aglyph code.
 26. The method of claim 14, wherein the watermark comprisescontent dependent portions of each page printed using at least one offluorescing black toner and fluorescing black ink.